Describe Azure Network Security Groups

Now that you understand the network segmentation and the components that make up your network, we can discuss the security features to protect the network. The first of these is the NSG. An NSG is a security solution within Azure that is associated with a subnet or network interface within the VNet to enforce a list of inbound and outbound rules. The NSG provides protection at the network security layer.

Figure 8.1 shows the architecture for an NSG when used to enforce rules across the entire subnet. The NSG is associated with the subnet and therefore has allow or deny rules that can protect resources within that subnet. In Figure 8.1, this is illustrated with a Linux and a Windows virtual machine to protect management ports 22 and 3389 respectively on the left side of the diagram. On the right, these ports are open to the internet and are exposed to potential attacks:

Figure 8.1 – NSG architecture

There are...